Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Ericsson and Intel Offer Remote Notebook Lockdown

Posted by timothy on Thu Dec 11, 2008 09:02 PM
from the and-if-you-refuse-this-offer dept.
Portables Security Hardware
MojoKid writes "Ericsson and Intel have announced that they are collaborating on a way to keep your laptop's contents safe when your laptop goes MIA. Using Intel's Anti-Theft Technology — PC Protection (Intel AT-p) and Ericsson's Mobile Broadband (HSPA) modules, lost or stolen laptops can be remotely locked down. Similar to Lenovo's recently announced Lockdown Now PC technology, the Ericsson-Intel technology uses SMS messages sent directly to a laptop's mobile broadband chip. Once the chip receives the lock-down message, it passes it to the Intel AT-p function, which is integrated into Intel's Centrino 2 with vPro technology platform. Unlike Lenovo's anti-theft solution, the Ericsson module includes GPS functionality as well."
+ -
story

Related Stories

Submission: Ericsson and Intel Offer Remote Notebook Lockdown by MojoKid (1002251)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Ericsson and Intel Offer Remote Notebook Lockdown 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • lapjacking (Score:5, Insightful)

    by Skapare (16644) on Thursday December 11 2008, @09:11PM (#26085419) Homepage
    And once the codes to do this leak into the wild, laptop hijacking and ransoms will be next.

    • Re:lapjacking (Score:5, Informative)

      by afidel (530433) on Thursday December 11 2008, @09:24PM (#26085513)
      If it's like Lenovo's solution you have two levels of authentication, first the SMS number which sent the message is whitelisted (fairly easy to spoof I assume) and secondly the messages are cryptographically signed. I believe the whitelist feature is to keep from being DDOS'd with bogus messages which the card would have to attempt to decrypt.
    • Unless the actual laptop owners get to set/change the codes themselves - as well as disabling the feature completely - in which case it won't be any worse than SSH/remote_desktop/et al.

      • they don't.
        at least not in my show where we are trialing it.
        this plus seagate momentus FDE disks and we're golden.

    • Can I make blow up with a simple SMS message? Reminds me of a "The Broken" episode. More thermite!

      • Can I make blow up with a simple SMS message? Reminds me of a "The Broken" episode. More thermite!

        Sure - just check the "Sony Battery" option.

    • I found this laptop and started writing this reply when it suddenly froz...

  • well (Score:5, Insightful)

    by scapermoya (769847) on Thursday December 11 2008, @09:23PM (#26085509) Homepage
    aside from the security risks, this can only become an effective deterrent if it sees widespread use.
    good luck with that.

    • Re:well (Score:5, Insightful)

      by fuzzyfuzzyfungus (1223518) on Thursday December 11 2008, @09:28PM (#26085569) Journal
      I suspect that this is less about deterrent and more about mitigating data loss. Laptops are cheap(and, given that this hardware and service aren't exactly going to be free) the cost of replacing some when they get stolen is probably lower than building all sorts of fancy features into them. Being able to nuke the data on the system(specifically, nuke the crypto keys to the disk's already encrypted contents) could be well worth the money for a fairly broad swath of business type purposes.

      • Here's how I would build a lock-downable laptop:

        BIOS/preboot environment: Looks to an external device, probably a USB stick, for part or all of the crypto key. Use that to decrypt boot loader on hard disk or other boot device and follow its instructions. Of course this should have a passphrase.

        Boot loader will look to whereever it chooses for crypto keys for the rest of the drive. These may be the same keys as the bootloader used or they may be something else. They may be partially or completely downlo

        • Terrible idea. Now you have yet another failure point - losing the off-drive crypto keys. You don't even need to physically lose the USB key - just break it, have it die from static discharge, etc.

          People lose things a lot more expensive all the time - ask anyone who's ever lost a cell phone, or left a laptop on the roof of their car, or lost their wallet or purse.

            • so uhm, keep a copy somewhere secure?

              That still relies on the average user not being a retard, and having the presence of mind to do so. Sorry, and that ain't happening any time soon.

              Remember, the moment you design an idiot proof system, someone invents a better idiot.

            • so uhm, keep a copy somewhere secure?

              So why not just keep the laptop there instead?

              Answer: Because I want to USE it.

              In other words, this whole idea detracts from usability and convenience, which is why people get laptops in the first place. Easier to just remove the HD. It's not like it takes more than a minute, or is very large. Most laptops, you don't have to use the screws that hold the drive caddy in place, so just remove the 2 screws holding down the cover, pop the drive out, and your half-teraby

              • Re: (Score:3, Insightful)

                by sumdumass (711423)

                The problem with a thumb drive security stick or removable hard drives and such is that they will all end up in the same bag as the laptop making the separation pointless when someone takes the entire enchilada.

                Sure, you can keep them separate but lets be practical here. Keys end up making it onto key rings with other keys, phone numbers all make it to the same places, and so on. It will either be something that is lost or kept together for convenience reasons.

                • Nyet.

                  My thumbdrive (a Sandisk Cruzer Micro, the only thumbdrive I've ever found which fits securely next to my car keys) lives on my keyring. It hangs from the beltloop of my pants on a carabiner, and is always right there whenever it is not in use elsewhere.

                  So let's be practical. I don't think anybody is going to steal the thumbdrive on a key ring which is attached to my pants, along with my laptop, as long as I'm vigilant in removing the thumbdrive from my laptop whenever I'm out of sight of said laptop

                  • don't think anybody is going to steal the thumbdrive on a key ring which is attached to my pants, along with my laptop
                     
                    The way this parses, you make it sound like your laptop is attached to your pants.

                  • My thumbdrive lives on my keyring. It hangs from the beltloop of my pants on a carabiner, and is always right there whenever it is not in use elsewhere.

                    And who says slashdotters don't have any fashion sense?

        • My understanding is that the crypto keys are off drive, typically stored in the TPM or whatever half-assed vendor equivalent is included. That is baked into the motherboard somewhere, so it will be lost with the machine; but pulling keys out of a TPM is said to be markedly less fun than just pulling them off a drive, and features like this one are aimed at making it even more irritating. If you have to have a separable token of some kind, TPMs can be made to play with smartcards(or fingerprint scanners, if

        • What are you trying to accomplish with all these extra steps that any ordinary full disk encryption mechanism can't provide do right now?

      • I'm guessing this will only be useful for certain types of users. There are two real theft goals: either the thief is after the computer or after the data. I don't have the numbers, but I suspect the thief is after the computer (to sell on eBay, etc.) 95%+ of the time. Assuming this does actually make the computer inoperable, the thief will simply throw it out when it stops working (you won't get your computer/data back, and he doesn't care what was on the disk). If the thief needed to retrieve data from

        • Re: (Score:3, Informative)

          by networkBoy (774728)

          Intel V-pro is on even when the computer is "off" unless on battery or no AC then V-Pro is on.

          You can configure it to be:
          on in S0 only
          on in S0 and suspend
          on in S0, Suspend, Hibernate, S5 (off, living on VSB power).

          in the last mode listed it will accept a poison pill even when "off", so long as there is a network connected.

          We've got a dozen machines with this in my shop right now. pretty cool tech. Not targetted at Joe sixpack, but I could see some hard-core geeks using it to turn on their machine remotely

        • no, the funny thing is you're comparing some lame remote administration application with hardware/BIOS-based security features. you might as well install netbus/Back Orifice 2000/sub7 on your computer for all the good it'll do you. all the thief has to do is take out the laptop hard drive and mount it onto another system and they've bypassed this "cutting-edge" security program developed for government use in the "War on Terror" (yes, that's an actual line used by the makers of that software).

          while the Leno

    • That, and it has to be hooked up to the internet whenever the SMS is sent. Unless of course the code does not run directly in firmware and the thief wipes the OS for a different (non-OEM in the case of Windows) one. If I stole one of these, thats what I would do, stay away from the 'net until its been wiped for Linux or a copy of retail Windows (e.g. out the box).

      But all they have to do is make this tie into firmware/BIOS so the OS running on top has 0 control, which is still easily disabled by either ph
      • Scratch that, just remove the mobile broadband chip while its off (possibly sleeping or hibernating) then have fun either reinstalling an OS on it for personal use or decrypting the hard drive and having your way with the user's data.

        Read the article this time.

        • Re: (Score:3, Informative)

          by tomhudson (43916)

          Scratch that, just remove the mobile broadband chip while its off (possibly sleeping or hibernating) then have fun either reinstalling an OS on it for personal use or decrypting the hard drive and having your way with the user's data.

          ... or just move the little switch on the front of the laptop (I didn't even notice it was there until one day I accidently turned it off and I couldn't get the wireless working).

          Removing the chip on recent HP laptops is really easy - almost as easy as upgrading ram - it's

  • Government backdoor (Score:5, Insightful)

    by Lead Butthead (321013) on Thursday December 11 2008, @09:24PM (#26085521)

    The question is if this... feature has a government backdoor to 'assist' in 'terrorism investigation.'

    • Re:Government backdoor (Score:4, Interesting)

      by TheGratefulNet (143330) on Thursday December 11 2008, @09:27PM (#26085553)

      many of us are thinking that, too.

      it took 'this long' to come out with it. but its not really a 'hard' problem. think 'coordination' and 'keys' and 'multiple owners' and I bet you are thinking what I am.

      this is a feature I would search to NOT have, quite frankly. and if I wanted it, *I* would implement it in a one-off private way.

    • The question is if this... feature has a government backdoor to 'assist' in 'terrorism investigation.'

      Forget terrorism.
      This is a wet dream for drug dealers, organized crime, corrupt politicians etc.

      Normal procedure is to keep the computer as-is until they can do their forensics.
      So unless the police have a faraday cage or pull the HSPA chip in time, they're screwed.

      So you pretty much have to assume that there's a backdoor,
      otherwise law enforcement and the Feds would be shitting bricks.

  • So when they see that their newly stolen laptop suddenly stops functioning, what do they do? They ditch it somewhere, and I don't mean sell it. You'll NEVER get it back then. I mean yeah it's supposed to stop people from stealing your much more valuable personal data but that should be password protected anyway with a directory hider/protector (not like a compressed archive file with a password cuz that's too slow) so why bother? Now people can just fake the signal and shut your laptop off so it seems l

    • Re:horrible idea (Score:5, Insightful)

      by tomhudson (43916) <hudsonNO@SPAMvideotron.ca> on Thursday December 11 2008, @10:27PM (#26086011) Journal
      It'll become a source for used/spare parts. Need a battery? A charger? A new screen because you left your lappy on the car roof and drove off? A new keyboard because you spilled crap on it? A bigger hard drive? Extra ram? A new case? A spare drive caddy and connector? A cheap DVD/Blu-Ray upgrade?

      The easily-disposed-of parts of a disassembled laptop are worth as much as the whole lappy.

    • Re:horrible idea (Score:5, Insightful)

      by SanityInAnarchy (655584) <ninja@slaphack.com> on Thursday December 11 2008, @10:44PM (#26086155) Journal

      I mean yeah it's supposed to stop people from stealing your much more valuable personal data but that should be password protected anyway with a directory hider/protector (not like a compressed archive file with a password cuz that's too slow) so why bother?

      Your ignorance is showing...

      Compressed archive files are plenty fast, depending on what you're trying to protect. The real problem is, what happens when you "open" them? Most of the time, it'll be unpacking them to a temporary directory, opening them with some random program on your (unencrypted) hard drive (likely without anything to prevent it from being swapped out, so now your stuff is on disk in the clear twice), saved back to the temporary folder (three times, if you're still counting), and put back into the archive.

      Plus, there's now a mention in Recent Documents, and all kinds of other information letting people know, at the very least, that you have some encrypted files, and what their names are.

      This applies to Truecrypt also, by the way, unless you're using it for fulldisk encryption.

      And if you're encrypting the whole disk -- where will you keep the encryption keys? How will you boot? Doing it in hardware suddenly makes sense -- probably a slight performance boost, also.

      And once you're doing that, having a way to remotely destroy the crypto keys also makes sense -- if you're paranoid enough to encrypt your whole hard drive, this is the next best thing to putting thermite in the case and triggering that remotely instead.

      It's not a deterrent, it's a way to make the crypto much more secure.

      • And if you're encrypting the whole disk -- where will you keep the encryption keys? How will you boot?

        I don't know about Truecrypt, but using the standard methods in GNU/Linux (I don't even know what it's called, beyond that it uses LUKS and the command I use is called "cryptsetup"), the encryption key will be on the hard drive itself, encrypted with a symmetric cipher (and ideally you would have a reasonably strong passphrase committed to memory).

        On GNU/Linux "full disk encryption" requires a small unencrypted partition which contains the kernel and initrd, and initrd has the tools to decrypt the other par

  • It won't solve for another problem: losing the computer in an area without signal (like a train).

    If the thief is smart (which is normally not the case), he can remove the hard drive right on the train or in that same area and completely avoid the SMS message. Unless, of course, the SMS can somehow be sent to the security chip without the interference of an operating system.

    When I lost my Treo in the subway, the Good administrator for my hosted email service could not remote wipe the phone because it could never find service. It's possible that someone removed the SIM right away, but I'm sure that I lost it while getting off the train.

    Nonetheless, it's a great idea that covers many other common circumstances. Fortunately, most thieves are petty thieves and wouldn't know that this module is there in the first place.
    • That's why Blackberry's are better than Treo's with Good, as soon as the device can talk GPRS or better it will get the wipe signal based on its PIN, it's not tied to the SIM.
      • There are a lot of reasons why Blackberry devices are better than anything Good Technology can put out. Start with the basic stuff like UI and work your way up.

    • Re:It's a good idea, but... (Score:5, Funny)

      by ceoyoyo (59147) on Thursday December 11 2008, @10:06PM (#26085875)

      Foil lined laptop bags. For the modern laptop thief on the run.

  • So, anybody else remember when we talked about [slashdot.org] "digital manners policies", the delightful form of DRM where devices selectively disobey you based on their environments?

    Well, reading the patent application linked to in that article should give you all kinds of delightful ideas about what you could do with a computer that has some sort of embedded supervisor processor with GPS and a cell data link...

  • Parts are worth more (Score:5, Funny)

    by Matt Perry (793115) on Thursday December 11 2008, @10:00PM (#26085829)

    No problem. Laptops are worth more when you sell the parts individually rather than the whole thing.

  • I am getting that creepy OnStar vibe... (Score:3, Interesting)

    by Phizzle (1109923) on Thursday December 11 2008, @10:57PM (#26086237)
    Another great "Big Brother" innovation. Can't you just imagine, during the next "threat escalation" all laptops get cockblocked "just in case" for the Greater Good ®, of the patriotic nation?

  • Relying on cell phone communication? If it's GSM, it's already been p0wn3d. info [binrev.com]. At the moment, it's only within reach of large corporations, but those barriers are artificial. There's also been development on creating a fake base station using a USRP (google it), a very nice piece of hardware kit that can do the signals processing necessary... So the hardware exists for $1000 to pull this hack off. Failing that, just pop the screws and cut the antenna leads to the internal wifi (which is likely the same

    • P.S. Taking out the battery works too. ^_^ Then just flip your cell phone open, find a place with zero bars, and plop down.

      If you want to be fancy, build yourself a small faraday cage. Woo-woo...

      For This Project You Will Need:
      * replacement outdoor screening material, approx. 200sqft. You can get this at a Fleet Farm or online.
      * 4 2x8s
      * 2 2x16s,
      * 1 50" extension cord,
      * six metal rods approx. 6" in length (suggest construction reed bar)
      * power stapler
      * wood glue (or similar)
      * hacksaw
      * pile driver

      Note: You don

    • Re: (Score:3, Informative)

      by afidel (530433)
      I'm assuming they are using the secure instruction included in recent Intel CPU's to talk to the TPM1.2 chip in the laptop and deleting the decrypt key from the keystore therefore making the recovery from FDE like BitLocker basically impossible.

        • Re:The hard drive maybe (Score:5, Informative)

          by afidel (530433) on Thursday December 11 2008, @10:39PM (#26086101)
          Taking the HDD out gains you NOTHING, in theory it's already fully encrypted with 256 bit AES which is uncrackable by any currently known method. The idea is that there is only one real vulnerability in a TPM based system and that is the TPM chip's keystore and the databus that the TPM chip uses to talk to the CPU, if you erase the keystore and thus makes sure that both those pathways are neutralized there should be no possible way to retrieve the data off the disk. There's still the cooled RAM trick and possibly a trace of the key left in the disk controller's cache, but those are both VERY sophisticated attacks that have a very low chance of working even in lab conditions. Oh and I just thought of something, if the TPM keystore is wiped then the TPM trust web collapses and the machine should reboot thus flushing the key from ram.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.